Hello and welcome this recording on a feature of WPA3 called Beacon Protection.
So let's just do a quick review of what beacons are.
So beacon frames are 802.11 management frames and they're used for a lot
of different reasons.
Certainly you probably know that they're used by wireless LAN clients
to discover the wireless LAN.
You know what SSIDs are around me and what are their capabilities?
Inside the beacon it says things like what authentication mechanisms are
in use, what encryption mechanisms are in use, what channels are in use,
a whole bunch of things.
Beacons are cram full of information.
They also help the wireless LAN clients to maintain their association
to the wireless LAN.
A wireless LAN client has to be able to receive beacons if for some reason
either because the client has moved too far away or there's been an increase
in radio frequency interference and it can no longer receive beacons that
clients can have to look for a different wireless LAN to associate to.
Now beacons are sent in plain text and unencrypted so if you do a Wi-Fi
sniffer trace you can read them from beginning to end.
Now once associated to a wireless LAN beacons spoofing could occur in
which case you've got a rogue access point sending out its old beacons.
The worst case scenario is where you've got an access point that's actually
spoofing the MAC address of your legitimate access point but the beacons
the rogue MAC address is sending are giving clients faulty or incorrect
information. It can result in the disassociation of clients, rate limiting
the client you know what if the rogue access point says oh I only support
this wireless LAN only supports one megabit per second and that's it.
Wow imagine how that's going to really impact your Wi-Fi if you start
believing that and rate limit yourself down to that.
It can even force you off onto a different channel by sending a channel
switch announcement.
So WPA3 added beacon protection to reduce some of these risks.
So how are they protected?
Well if you've seen my video on WPA3 protected management frames PMF guess
what the same concept applies here.
So the idea is we can't encrypt beacons so beacons still have to be sent
in plain text so that everybody can read them even clients who aren't
associated to the wireless LAN yet but are considering it.
So we can't encrypt it but we can validate the integrity and authentication
of the beacon by adding a message integrity code or a MAC.
So we've got the access point we'll use a special key just for this purpose
temporal key the big TK.
So just like there are other keys that the access points will give to
the clients for example the group temporal key the the IG TK those and
this one are transmitted in Epos over LAN key message number three.
So you have to go through that four -way handshake in order to receive
this key. Now what does this mean for clients who aren't associated to
the wireless LAN yet?
Well they'll still be able to receive those beacons and and parse them
and see what's inside them it's just until they're actually associated
to the wireless and have gone through the Epos over LAN handshake they
won't be able to parse that message integrity code and they won't be able
to tell if the access point is a legitimate or rogue access point until
they've gone through that part.
So this is only for for integrity not encryption and it's shared among
all clients just like the group temporal key is they're associated with
that SSID. Now in order to have this feature you have to have protected
management frames turned on.
So this is not an independent feature this is something that is optional
but if you want it you have to already be running PMF.
Now if you're running Wi-Fi 7 or higher it turns out that beacon protection
just like protected management frames is required.
Now actually in WPA3 protected management frames is already required at
least on Cisco devices you can't create a WPA3 wireless LAN without having
protected management frames.
Now beacon protection as a side thing is a side feature is optional in
Wi-Fi 6E and lower but above that you've got to have it.
Now how do we actually enable it?
Well on 17.15 code or later and that's a critical thing here if you're
going to be actually doing this in the lab make sure your controller is
running 17.15 or higher then you will see when you select WPA3 as your
wireless LAN type there will now be a checkbox that you can check for
beacon protection.
Now how do we actually know if it's actually working if it's doing anything?
Well if you open up your beacon frame you will see here under extended
capabilities octet 11 so this will be like the last octet under extended
capabilities if you open that up you'll see a flag set to number one saying
beacon protection enabled yes it's true and then down at the bottom of
the beacon I had to cut out some stuff here but the bottom you'll see
this additional element called the management mik element and this actually
contains the message integrity code so these two things taken together
provide your validation that the beacon protection feature is on.
Now there's really no way to see the actual big tk just like there's no
way to see the group temporal key because even though it's transmitted
from the access point to the client in Epos-Rlan key message number three
remember that Epos-Rlan key message number three is actually the contents
of it are encrypted with the key encryption key that was derived in message
number one so we can see down here the WPA key data and this is going
to be our group temporal key possibly an iGtk and the big tk if we're
doing that as well and this is all encrypted with the key encryption key
between the client and the access point so just some final thoughts on
this so beacon protection will only protect the client from rogue access
points that are attempting to spoof via mac duplication the legitimate
access point if somebody has a rogue access point out there and they haven't
bothered to do that they say you know what i'm going to insert an access
point that's advertising the exact same SSID as the corporate SSID and
i'll just leave my own mac address alone i'm not going to change it well
then beacon protection doesn't protect against that remember ultimately
it's up to the client to decide which access point it's going to try to
join and that's typically based on the power or the clarity of the signal
that the access point has in its beacon so if my legitimate corporate
access point is behind a couple of walls for me and the signal is you
know moderate to weak and all of a sudden a rogue access point is placed
right in the same room as i am chances are pretty good that my client
will try to join to the rogue access point and this feature is not going
to prevent that one final thought older Cisco wave two aeronaut access
point models and you've got some models here unfortunately do not have
the hardware capability to support beacon protection so if you want to
try to do this in the lab with your own access point that maybe you bought
off of ebay or something make sure you don't buy one of the older ones
like this because you won't be able to do it so that concludes this video